Field Notes: What Is STRIDE? A Quick Look at a Practical Threat Model
Six letters, six ways a system can be attacked. STRIDE turns "what could go wrong?" into a checklist.
Developed at Microsoft in 1999 by Loren Kohnfelder and Praerit Garg, the purpose of STRIDE is to take the core defensive principles of cybersecurity (think CIA triad) and flip each one into the threat that attacks it. That gives teams securing networks or developing software a systematic way to ask "what can go wrong?" and build the fix in from the start.
The six categories
| Threat | What it means | Property it violates |
|---|---|---|
| Spoofing | Impersonating someone or something else | Authentication |
| Tampering | Modifying data or code | Integrity |
| Repudiation | Denying an action you performed | Non-repudiation |
| Information Disclosure | Exposing information to someone not authorized to see it | Confidentiality |
| Denial of Service | Disrupting a system by exhausting its resources | Availability |
| Elevation of Privilege | Gaining access beyond what you're authorized for | Authorization |
For example, the "T" in STRIDE stands for "Tampering," which corresponds to "integrity." Teams can ask themselves whether their systems or software allow tampering that could lead to a loss of data integrity. The same question works for each of the other five letters.
Advantages
STRIDE is versatile and scalable. It can be used by large organizations with sprawling, diverse networks and application deployments, or by a developer working on a single application.
Limitations
STRIDE's categories can be subjective and applied differently across teams in an organization. It also doesn't include a system to quantify threat impact, which makes it less granular than other models. It sorts threats by type but doesn't rank them, which is why it's often paired with a scoring model like DREAD.
Takeaway
STRIDE won't tell you which threat matters most, but it makes sure you at least ask about all six. For a design review, that habit of asking early is worth more than a perfect score.
Sources
- Security Compass. (2025, August 25). What is STRIDE in Threat Modeling?
- Cybrary. (n.d.). STRIDE-Threat Modeling Technique.
- IriusRisk. (2026). STRIDE Threat Modeling Methodology Explained.